Information Security Officer

DANE LLC•ARLINGTON, VA

1d•$125,000 - $145,000

About The Position

At DANE, we support some of the nation’s most complex programs with a team that blends technical excellence and true collaboration. We offer competitive benefits, generous PTO, and a culture where your work is recognized, impactful, and valued. We are seeking an Information System Security Officer (ISSO) to support the GSS 2.0 program. You will safeguard information systems assets and maintain security compliance across the organization, working with both IT teams and management. The successful candidate brings a strong foundation in Assessment and Authorization (A&A) activities and a solid working knowledge of the Risk Management Framework (RMF) and NIST cybersecurity publications.

Requirements

Bachelor’s degree (BA/BS) or equivalent
Must be a U.S. Citizen
Must be able to obtain and maintain a Secret security clearance
Minimum 5 years of IT Security experience
Strong working knowledge of NIST Special Publications, including NIST SP 800-37 and 800-53
Clear written and oral communication skills
Ability to troubleshoot and solve complex technical problems
Current certification in one or more of the following: ISACA – Certified Information Systems Auditor (CISA), ISACA – Certified Information Security Manager (CISM), (ISC)² – Certified Information Systems Security Professional (CISSP), (ISC)² – Certified Authorization Professional (CAP)

Nice To Haves

Experience with AWS

Responsibilities

Develop and coordinate all authorization documentation, including the System Categorization, System Security Plan (SSP), and System Risk Assessment
Support the control assessment, reporting, and continuous monitoring processes
Coordinate with the DoS liaison to provide POA&M status
Support and document Security Control Assessments, assist in remediation, and ensure POA&Ms are appropriately managed
Update the Business Continuity and Contingency Plan for the component
Conduct vulnerability scanning of IT systems and provide reports and metrics
Assist components with decisions that affect the security of their systems and networks
Assess information systems security requirements, evaluate current security posture, and recommend priorities for remediation
Review information system infrastructure and application architecture to assess security requirements
Review existing SA&A documentation, Security Assessment Reports, and security infrastructure (e.g., IDS, firewalls, vulnerability scan tools)
Assess NIST SP 800-53 Rev 4/Rev 5 controls and document results
Evaluate and strengthen SA&A documentation and work with the customer to maintain the system ATO
Perform and document risk assessments, analyzing security vulnerabilities and the metrics used to measure associated risk
Conduct annual NIST-based self-assessments, identify weaknesses, and develop a POA&M for each based on industry best practices
Monitor and analyze Intrusion Detection Systems (IDS) to identify security issues for remediation
Recognize potential, successful, and unsuccessful intrusion attempts and compromises through thorough review and analysis of event detail and summary information
Evaluate technology change requests and assess organizational risk
Assist with implementation of countermeasures or mitigating controls
Research, evaluate, test, and implement new security software or devices
Conduct investigations of information systems security violations and incidents, reporting to management as necessary
Implement, enforce, communicate, and develop security policies or plans for data, software applications, hardware, telecommunications, and information systems security education/awareness programs
Perform periodic and on-demand system audits and vulnerability assessments, including user accounts, application access, file system, and external web integrity scans to determine compliance
Provide information to management regarding the negative impact on the business caused by theft, destruction, alteration, or denial of access to information
Ensure compliance with regulations and privacy laws
Develop materials for computer security education/awareness programs
Respond to queries and requests for computer security information and reports
May serve as a team or task lead